Read the docs

wpweaver

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

wpweaver records in CISA KEV

No wpweaver vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Weaver Xtreme Theme Support 4 records HIGH Weaver Show Posts 1 record LOW Weaver Xtreme Theme 1 record LOW

Records

4 records in Weaver Xtreme Theme Support · all components

TI-2023-04576 CVE-2023-4971 · GHSA-q8w9-3c5w-2mhv

Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection

Priority HIGH 67

The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitab…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01186 Published 2023-10-16 Fixed in 6.3.1 CWE-502
TI-2023-00261 CVE-2023-0276 · GHSA-2237-qj4m-4cpq

Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS

Priority MEDIUM 58

The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-04-24 Fixed in 6.2.7
TI-2024-04592 CVE-2024-4939 · GHSA-74g2-v5gc-hj7f

Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode

Priority LOW 28

The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00273 Published 2024-06-05 No fix listed CWE-79
TI-2023-06391 CVE-2023-6990 · GHSA-p44f-cgp3-q8cf

Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user suppl…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00312 Published 2024-01-11 No fix listed CWE-79
Open these records in search →